YApi: Self-Hosted API Management Platform

Why teams need a dedicated API management platform

Once an API has more than a couple of endpoints, three groups need the same information in three different formats: backend engineers know the real response shape, frontend engineers need a fake version of it before the endpoint ships, and QA needs a definition precise enough to script an assertion against. A shared doc or a pile of Postman collections passed around in chat drifts out of date within a sprint, and nobody notices until a request breaks in staging. YApi's approach is to make the interface definition itself the one artifact all three groups read and write, with the mock server and the test runner built directly on top of that same definition instead of living as separate tools someone has to keep in sync.

What is YApi

YApi is a self-hosted, visual API management platform the YMFE team built to connect frontend, backend, and QA around one shared interface definition. Each API gets a page describing its request/response shape in Json5, a Postman-style debug console, and a mock endpoint generated from that definition via Mock.js. You run it on your own infrastructure, backed by MongoDB, so interface data never leaves your network.

Core features of YApi

• ✓Interface response shape and docs are defined once, in Json5, and both the mock endpoint and the documentation page read from that same definition.
• ✓MockServer supports plain random mocking plus a 'mock expectation' mode that matches specific request-filter rules and returns a fixed expected response for each one.
• ✓Built-in Postman-style debug console for calling an endpoint and inspecting the response without leaving YApi.
• ✓Automated testing with assertions against the response, so a broken contract can fail a check instead of surfacing in the frontend.
• ✓Data import from Postman collections, HAR files, and Swagger data, so an existing collection doesn't have to be rebuilt by hand.
• ✓Flat permission model that the README describes as scaling to large, multi-team projects while staying easy to use for smaller ones.
• ✓Runs entirely inside your own network, so interface data never touches a third-party server.
• ✓A community plugin ecosystem covering SSO, CAS, and OAuth2 login, GitLab sync, and DingTalk bot notifications, built by outside contributors.

Deploying YApi with yapi-cli

Deployment goes through YApi's own CLI. Install it with `npm install -g yapi-cli --registry https://registry.npm.taobao.org` — note the registry flag points at Taobao's npm mirror, which is the exact command the README ships, so confirm that mirror is reachable from your network before you rely on it. Running `yapi server` launches a visual setup wizard: fill in the configuration, click through the deploy steps, and it writes out the site. Start the server itself with `node {site-path}/server/app.js`, then open the site in a browser and log in with the admin email you set during setup — the default password is `ymfe.org`, changeable afterward from your profile. Requirements are Node.js 7.6+, MongoDB 2.6+, and git on the host. For process management, install pm2 globally and run `pm2 start "vendors/server/app.js" --name yapi`, with `pm2 info yapi`, `pm2 stop yapi`, and `pm2 restart yapi` for day-to-day control. Upgrades run through the same CLI: `yapi ls` lists available versions, `yapi update` moves to the latest, and `yapi update -v {version}` targets a specific one; the README says an upgrade only re-syncs the vendors directory and leaves existing project data alone. The README also links out to several unofficial Docker and docker-compose setups if you'd rather containerize it, though none of them are maintained by the core project.

YApi alternatives

Frequently asked questions

Best use cases

• •Keeping one interface contract that frontend, backend, and QA all read from during active feature development.
• •Mocking a dependent API before the real backend endpoint exists, so frontend work isn't blocked on backend sequencing.
• •Running automated response assertions as a regression check when an API contract changes.
• •Migrating an existing Postman or Swagger collection into a shared, internally hosted docs hub.
• •Enterprise setups that need a permission model flexible enough for many teams and projects but simple enough not to need a dedicated admin.

Who should try it — and who should skip

Try YApi if you're running a team where frontend, backend, and QA genuinely need the same interface definition and you're fine operating a Node.js and MongoDB service for it — the mock-expectation feature in particular pays off once QA is writing real test scenarios instead of eyeballing random JSON. Skip it if you don't want to own a self-hosted service at all, or if your workflow is a single developer working solo and a lighter tool like json-server would cover the mocking need without the setup.

Related repositories